Mobile electronic units employing applications requiring information on their geographical positioning contain means for estimating their position as accurately as possible. To do this, satellite geolocation systems are commonly used, these systems being denoted by the acronym GNSS (or Global Navigation Satellite Systems). An example of a GNSS is the GPS (or Global Positioning System).
It is necessary that these position estimations be integral and accurate for critical positioning applications. A critical positioning application denotes an application in which estimations of position must have a high degree of reliability. For example, such is notably the case for pay-per-use systems for insurance, parking and road networks, as well as electronic law enforcement systems such as electronic tagging devices or equipment for the tailing of suspects by police. Furthermore, applications for tracking inventory such as containers or driver assistance applications are also considered to be critical positioning applications.
The units used in systems employing critical positioning applications are usually tamper-resistant and use secure communication means. These units are also called Onboard Units and are denoted by the acronym OBU.
However, the radio link between the unit and the satellites belonging to the GNSS is usually implemented using an unprotected signal and is accessible to all. It is consequently possible for a user with malicious intent to disturb the normal operation of the unit so that the latter acquires falsified position estimations. These falsified estimations are usually transmitted by radio to processing servers, the operation of which is then also falsified. This type of fraud is possible without the pirate user even modifying the OBU. To do this, a low-cost device may be used, for example a device capable of receiving GNSS signals and retransmitting them after having modified them. The retransmitted and modified signal replaces the real signal originating from the satellites of the GNSS and the unit estimates an erroneous position.
In the case of a system implementing a payment application, the triggering of a payment is linked to pricing events triggered by the passage of the OBU through virtual gates or on entry/exit of a geographical zone. In this case, the device used for the fraud may be designed to neutralize pricing points while appearing compliant at control points, and to minimize these deviations from the real trajectories to avoid detection.
Existing methods make it possible to verify the operation of OBUs. This verification is performed statistically at fixed or mobile control points. Another way of proceeding is to verify a posteriori the consistency of the pricing events, for example by cross-checking the pricing events with the registration plates of the vehicles observed in the pricing zones. However, a fraud device may be designed to be silent during checks, since the position of check zones may be published by a centralized service, on the model of anti-speed camera radar devices.
Various methods for controlling the consistency of position estimations exist. This consistency may be verified by monitoring the absolute or relative power of the GNSS signals or by monitoring the power of the signal for each satellite.
The consistency of measurements may also be verified by using digital marking techniques notably allowing units to locate the emitters of a network. This technique is often denoted by the term “watermarking”. An example of implementation of watermarking is disclosed in the patent application WO 2009/037133.
A large number of OBUs already deployed and in operation do not include such techniques for verifying the consistency of position estimations. To update these receivers, i.e. to include functionalities enabling them to verify the consistency of the measurements, it would be necessary to alter each receiver, which would incur substantial workforce costs.
Furthermore, these techniques do not make it possible to guarantee the integrity of the estimations. Sophisticated attacks may circumvent them, at least in part. For example, a trajectory may be modified with a slight deviation in gyration in relation to the real trajectory, to counter the consistency verification with data originating from an onboard inertial sensor in the vehicle, for example.